Vulnerability Name:

CVE-2006-0913 (CCN-24819)

Assigned:2006-02-20
Published:2006-02-20
Updated:2018-10-18
Summary:SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi.
CVSS v3 Severity:3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Data Manipulation
References:Source: MITRE
Type: CNA
CVE-2006-0913

Source: CCN
Type: SA18979
Bugzilla Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
18979

Source: CCN
Type: Bugzilla Security Advisory February 20, 2006
2.18.4, 2.20, and 2.21.1 Security Advisory

Source: OSVDB
Type: UNKNOWN
23378

Source: CCN
Type: OSVDB ID: 23378
Bugzilla editparams.cgi whinedays Parameter SQL Injection

Source: BUGTRAQ
Type: UNKNOWN
20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4

Source: BID
Type: Vendor Advisory
16738

Source: CCN
Type: BID-16738
Bugzilla Whinedays SQL Injection Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2006-0692

Source: CCN
Type: Mozilla Bugzilla Bug 312498
editparams.cgi doesn't check whether 'whinedays' and 'mostfreqthreshold' are numeric

Source: CONFIRM
Type: Exploit, Patch, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=312498

Source: XF
Type: UNKNOWN
bugzilla-editparams-sql-injection(24819)

Source: XF
Type: UNKNOWN
bugzilla-editparams-sql-injection(24819)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:bugzilla:2.17.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.21:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.21.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:bugzilla:2.17.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.21:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.21.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.17.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.18:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:bugzilla:2.20:rc2:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    mozilla bugzilla 2.17.1
    mozilla bugzilla 2.17.3
    mozilla bugzilla 2.17.4
    mozilla bugzilla 2.17.5
    mozilla bugzilla 2.17.6
    mozilla bugzilla 2.17.7
    mozilla bugzilla 2.18 rc1
    mozilla bugzilla 2.18 rc2
    mozilla bugzilla 2.18 rc3
    mozilla bugzilla 2.18.1
    mozilla bugzilla 2.18.2
    mozilla bugzilla 2.18.3
    mozilla bugzilla 2.18.4
    mozilla bugzilla 2.19
    mozilla bugzilla 2.19.1
    mozilla bugzilla 2.19.2
    mozilla bugzilla 2.19.3
    mozilla bugzilla 2.20
    mozilla bugzilla 2.20 rc1
    mozilla bugzilla 2.20 rc2
    mozilla bugzilla 2.21
    mozilla bugzilla 2.21.1
    mozilla bugzilla 2.17.3
    mozilla bugzilla 2.17.5
    mozilla bugzilla 2.19.1
    mozilla bugzilla 2.19.2
    mozilla bugzilla 2.21
    mozilla bugzilla 2.21.1
    mozilla bugzilla 2.17.1
    mozilla bugzilla 2.17.4
    mozilla bugzilla 2.17.6
    mozilla bugzilla 2.17.7
    mozilla bugzilla 2.18.1
    mozilla bugzilla 2.18.2
    mozilla bugzilla 2.18.3
    mozilla bugzilla 2.18.4
    mozilla bugzilla 2.18 rc1
    mozilla bugzilla 2.18 rc2
    mozilla bugzilla 2.18 rc3
    mozilla bugzilla 2.19
    mozilla bugzilla 2.19.3
    mozilla bugzilla 2.20
    mozilla bugzilla 2.20 rc1
    mozilla bugzilla 2.20 rc2